SSL should accept cert content, instead of just cert file path

[ricolin]

BPO	34257
Nosy	@tiran, @njsmith, @ricolin, @j-rewerts

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2018-07-29.04:27:57.911>
created_at = <Date 2018-07-28.10:31:52.049>
labels = ['expert-SSL', 'type-feature']
title = 'SSL should accept cert content, instead of just cert file path'
updated_at = <Date 2018-07-29.04:54:21.015>
user = 'https://github.com/ricolin'

bugs.python.org fields:

activity = <Date 2018-07-29.04:54:21.015>
actor = 'j-rewerts'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2018-07-29.04:27:57.911>
closer = 'njs'
components = ['SSL']
creation = <Date 2018-07-28.10:31:52.049>
creator = 'rico-lin'
dependencies = []
files = []
hgrepos = []
issue_num = 34257
keywords = []
message_count = 3.0
messages = ['322539', '322609', '322610']
nosy_count = 4.0
nosy_names = ['christian.heimes', 'njs', 'rico-lin', 'j-rewerts']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue34257'
versions = ['Python 3.5']

[ricolin]

Currently, SSL module [1] only allows file path as input.
That led to a lot of libraries only accept file path to a local file.
This lead to issues when people who trigger this python code, didn't have any right to access a local file. Here are two examples:

1. In multi-cloud orchestration service design, you (as an operator) like to create resources in another cloud with orchestration service(like Heat in OpenStack), but you like to set up SSL for this connection. You should not allow accessing a local file from the first cloud (where the orchestration service is running). And you can't guarantee the first cloud provider allow you to inject a Cert file in their environment. In this case we need to allow operators to input their own cert information and parse it to ssl option for request.

2. Serverless. In serverless, we give a python code and cloud will provide an environment to run it. We can try to inject cert when we try to create environment for operators, but it will be more secure to directly pass it to python instead of store it around.

The first case is what we're looking for an answer. Didn't look into the design for the second case, but I guess that might face the same issue.

[1] https://github.com/python/cpython/blob/master/Modules/_ssl.c#L3683

[njsmith]

This is a duplicate of bpo-16487, which has more discussion about how the API might work.

[j-rewerts]

Also PEP-543 is related to this. In addition, I think PyOpenSSL provides support for what you want.